EleutherAI presents 'Deep Ignorance', a research paper studying pretraining data filtering as a tamper-resistant safety mechanism for open-weight LLMs. Unlike post-hoc safeguards (refusal training, input filters) that are easily bypassed via jailbreaks or fine-tuning, filtering dangerous knowledge from pretraining data prevents models from acquiring it in the first place. Using biorisk knowledge (WMDP-Bio benchmark) as a testbed, they trained 6.9B parameter models on 550B tokens with and without filtered data. Key findings: (1) filtering can reduce biorisk benchmark performance to near-random chance with minimal degradation to general capabilities; (2) filtered models remain noticeably safer even after adversarial fine-tuning on biorisk papers, unlike circuit-breaking approaches which collapse immediately; (3) however, filtered models can still leverage dangerous knowledge provided in-context (e.g., via RAG), suggesting filtering should be combined with other defenses. The pipeline uses a blocklist of ~6k terms plus a ModernBERT-Large classifier, processing 400M+ documents with under 1% additional compute cost.
